Stored in Australia
The household's information and every photo, document, recording and song are stored with Amazon Web Services in its Sydney region.
Encrypted
- The database is encrypted at rest with a key held in AWS Key Management Service, which is rotated automatically.
- Photos, documents, recordings and songs are stored encrypted at rest.
- Everything travels over encrypted (HTTPS) connections.
Private to each household
- Only people a household's manager invites can see it, and each is a viewer, contributor or manager.
- Every request is checked against who belongs to the household, and the database applies its own row-level security rules as well, so one family can't see another's information.
- Files are never public. The app opens them through private links that stop working after a short time, usually an hour or less.
Signing in
You sign in with your email address and a password, or with Google. Your password is checked by the sign-in service without being sent to us, and we never store it.
The tablet and carers
- Nobody signs in on the tablet. It is paired with the household by a short code that a manager types into the family app. A manager can unpair it at any time; when it next connects, the tablet removes the photos and songs it kept for offline use.
- Carers use a 4-digit PIN on the tablet. PINs are stored scrambled, never as the number itself, and after 5 wrong tries in a row the tablet stops accepting PINs for 5 minutes.
Links you control
- Emergency links for paramedics expire after the time you choose (72 hours unless you pick otherwise). A manager can turn one off at any time in Their care, and can see how many times it has been opened.
- Documents opened from an emergency link use their own links that stop working after 15 minutes.
- A doctor or hospital link only lets them send documents to the household; it shows them nothing. These links expire too, or last until you turn them off.
Our staff
- Only our staff with administrator access can open the Ops Console, and every household search and view there is logged with who did it.
- If you ask us for help and we need to see what you see, "View as this household" is read-only, needs a written reason, ends after 30 minutes and is logged. While it's open, the household's managers see who is looking and why at the top of Their care, and can end it straight away.
- Permanently deleting a household needs two different staff members to agree, and is logged.
Backups
The database is backed up automatically, and backups are kept for 14 days so we can recover from a fault.
Your copy
A household's manager can download everything at any time, on any plan: in Billing, choose Download everything.
Tell us about a problem
If you think something isn't secure, or you've found a weakness, please email us straight away.